3663f628c7f972e2f6d783fbbd7a8237_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3663f628c7f972e2f6d783fbbd7a8237_JaffaCakes118
Size

329KB
MD5

3663f628c7f972e2f6d783fbbd7a8237
SHA1

2cd2145c6c5d22112728c2b4fedc57f5afdedabd
SHA256

dd0996d1ccab7609af411a987651a874f438c4d44395c1ba0b54b8a3227e2fe6
SHA512

f1602a83d53aaf2fddeca62bac35bc80ea159dc62a5beb48119f8822f3726ee6618d1178f8ed51266633761d7359416b4c6ce21d5ac9e5751abe72414ff05bd7
SSDEEP

6144:gzMJtovbDT5f3oyIcb8MMD4FuDiMYA2qu5SfCXWIE3EH0Zs3qJp+bSQcN9:UD3xR9hurY9qQSi5OZs3t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
3663f628c7f972e2f6d783fbbd7a8237_JaffaCakes118

Files

3663f628c7f972e2f6d783fbbd7a8237_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9f40d590605610d5f5bb778561713abc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharLowerBuffW
wsprintfW

kernel32

UnregisterWait
WriteFile
DebugBreak
FreeLibrary
lstrcmpiA
GetProfileStringA
lstrlenW
OpenEventW
VirtualAlloc
GetCurrentThreadId
FileTimeToSystemTime
lstrlenA
FormatMessageW
OpenFileMappingW
GetLocalTime
LocalAlloc
InterlockedExchangeAdd
LoadLibraryA
UnhandledExceptionFilter
GetTickCount
GetSystemInfo
GetLastError
CreateFileW
GetComputerNameExW
LocalFree
InterlockedExchange
DeleteCriticalSection
Sleep
EnterCriticalSection
MultiByteToWideChar
InitializeCriticalSection
RaiseException
CreateEventW
OutputDebugStringA
LeaveCriticalSection
GetACP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleHandleW
GetCurrentProcess
UnmapViewOfFile
InterlockedIncrement
GetProcAddress
LoadLibraryW
GetModuleFileNameW
lstrcmpW
GetComputerNameW
lstrcpyW
RegisterWaitForSingleObjectEx
MapViewOfFileEx
WideCharToMultiByte
SetEvent
GetModuleFileNameA
ExpandEnvironmentStringsW
InterlockedDecrement
CreateFileMappingW
CloseHandle
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
InterlockedCompareExchange
QueryPerformanceCounter
CreateFileA
GetCurrentThread
TerminateProcess
GetEnvironmentVariableW

msvcrt

_wcsnicmp
sprintf
_ultoa
malloc
wcsrchr
swprintf
_initterm
wcscpy
_vsnprintf
_adjust_fdiv
wcslen
wcscmp
wcsspn
sscanf
qsort
_wcsicmp
wcstoul
strchr
_strcmpi
strrchr
_except_handler3
free
_stricmp
_strnicmp
wcscat

ntdll

RtlCopySid
NtClose
RtlDowncaseUnicodeString
RtlDeleteTimerQueue
RtlFreeUnicodeString
RtlRunDecodeUnicodeString
RtlInitializeSid
RtlDeregisterWait
RtlCreateTimerQueue
NtSetSecurityObject
RtlDeleteCriticalSection
RtlLookupElementGenericTable
NtQuerySystemTime
RtlEraseUnicodeString
RtlLeaveCriticalSection
RtlAppendUnicodeStringToString
RtlAcquireResourceShared
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
NtAllocateVirtualMemory
RtlIntegerToUnicodeString
DbgPrint
RtlUnicodeStringToAnsiString
RtlDeleteElementGenericTable
RtlOemStringToUnicodeString
NtCreateEvent
RtlEnterCriticalSection
RtlFreeSid
RtlVerifyVersionInfo
RtlAcquireResourceExclusive
RtlUniform
RtlEqualDomainName
RtlSubAuthorityCountSid
NtOpenProcessToken
RtlReleaseResource
RtlAddAccessAllowedAce
NtOpenThreadToken
RtlCompareMemory
RtlCreateTimer
RtlConvertSharedToExclusive
RtlFreeAnsiString
RtlPrefixUnicodeString
RtlCreateSecurityDescriptor
RtlTimeToTimeFields
RtlInitializeCriticalSection
NtQueryInformationToken
NtDuplicateObject
RtlInitializeGenericTable
RtlAllocateAndInitializeSid
NtWaitForSingleObject
RtlInitializeResource
RtlInitAnsiString
RtlValidSid
NtAllocateLocallyUniqueId
RtlCopyLuid
RtlCopyUnicodeString
RtlDeleteResource
RtlLengthRequiredSid
NtOpenEvent
RtlSubAuthoritySid
RtlConvertSidToUnicodeString
RtlInitializeGenericTableAvl
RtlCompareUnicodeString
RtlSetDaclSecurityDescriptor
RtlGetElementGenericTable
RtlInsertElementGenericTable
RtlUpcaseUnicodeString
RtlCreateAcl
RtlAnsiStringToUnicodeString
RtlNtStatusToDosError
VerSetConditionMask
RtlEqualUnicodeString
RtlInitUnicodeString
RtlRegisterWait
RtlSystemTimeToLocalTime
NtQuerySystemInformation
RtlEqualSid
RtlTimeFieldsToTime

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
FreeContextBuffer
CredMarshalTargetInfo
CredUnmarshalTargetInfo

msasn1

ASN1EncSetError
ASN1objectidentifier_free
ASN1BEREncBitString
ASN1bitstring_free
ASN1BERDecOctetString
ASN1intx2uint32
ASN1BEREncOctetString
ASN1BERDecU32Val
ASN1ztcharstring_free
ASN1octetstring_free
ASN1BERDecOpenType2
ASN1BERDecBitString
ASN1BERDecCharString
ASN1BERDecSXVal
ASN1intxisuint32
ASN1intx2int32
ASN1Free
ASN1BERDecS32Val
ASN1BEREncBool
ASN1BERDecSkip
ASN1DecAlloc
ASN1_CreateModule
ASN1BEREncSX
ASN1CEREncGeneralizedTime
ASN1BERDecNotEndOfContents
ASN1charstring_free
ASN1BEREncOpenType
ASN1BERDecObjectIdentifier
ASN1BERDecEndOfContents
ASN1BEREncS32
ASN1_CloseEncoder
ASN1BERDecZeroCharString
ASN1intx_setuint32
ASN1BEREncEndOfContents
ASN1BERDecExplicitTag
ASN1_CreateEncoder
ASN1intx_free
ASN1BEREncU32
ASN1BEREncCharString
ASN1BEREncObjectIdentifier
ASN1_Decode
ASN1_CreateDecoder
ASN1BERDecGeneralizedTime
ASN1_CloseDecoder
ASN1DecSetError
ASN1_Encode
ASN1_FreeDecoded
ASN1BERDecBool
ASN1BERDecPeekTag
ASN1_FreeEncoded
ASN1BEREncExplicitTag

cryptdll

CDLocateCSystem
CDFindCommonCSystemWithKey
MD5Init
MD5Final
CDLocateCheckSum
CDGenerateRandomBits
CDBuildIntegrityVect
MD5Update

advapi32

ReportEventW
RegEnumKeyExW
GetTraceLoggerHandle
QueryServiceStatus
CryptAcquireContextW
SystemFunction006
SystemFunction007
OpenSCManagerW
RegQueryInfoKeyW
RegisterEventSourceW
CryptGetHashParam
DeregisterEventSource
RegCreateKeyExW
RegDeleteValueW
OpenProcessToken
FreeSid
RegOpenKeyW
CryptReleaseContext
RegQueryValueExW
GetTokenInformation
CryptDestroyHash
CredUnmarshalCredentialW
CloseServiceHandle
RegSetValueExW
RegOpenKeyExW
SetThreadToken
RegCloseKey
LookupAccountSidW
CryptGetProvParam
RegNotifyChangeKeyValue
RevertToSelf
CryptSetProvParam
OpenThreadToken
CryptHashData
RegisterTraceGuidsW
QueryServiceConfigW
TraceEvent
OpenServiceW
RegConnectRegistryW
AllocateAndInitializeSid
CredFree
CryptCreateHash

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9f40d590605610d5f5bb778561713abc

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

msvcrt

ntdll

secur32

msasn1

cryptdll

advapi32

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB